# Automated employee offboarding sweep from SuccessFactors

> Every morning, employees whose last day has passed lose sign-in access, IT gets a recovery ticket, and your team gets one Slack update.

- Workflow type: code
- Services: SAP SuccessFactors, Okta, Jira, Slack
- Categories: HR & People, Operations
- Published: 2026-08-09

## What it does

- Checks your HR system every morning for employees whose last working day has already passed, and ignores anyone whose leaving date is still in the future.
- Blocks sign-in for each leaver first, so access is cut before any of the slower admin steps run.
- Opens an IT ticket per leaver to recover laptops and equipment and review any lingering access, with the leaving reason and last working day already filled in.
- Posts one short summary line per leaver to a private Slack channel, so IT has the context without opening the HR system.

## What you'll need

- An SAP SuccessFactors account with permission to read employment and termination records
- An Okta account with admin rights to suspend users
- A Jira project where IT offboarding tickets should be raised
- A Slack workspace and a private channel for the updates, for example #it-offboarding

## Prompt

Every morning at 6am in our company timezone, run a deterministic offboarding sweep that cuts off access for employees whose termination has already taken effect. Use a cron trigger. SuccessFactors does not emit outgoing webhooks for termination events, so a daily bounded query is the correct shape. Every step here is a known lookup or a known create, so build this as code with no judgement calls or drafting.

Step 1, find the leavers. Query SAP SuccessFactors with List Employment Terminations (EmpEmploymentTermination) for termination records whose effective date is today or earlier. This entity carries both the termination date and the termination reason, which I need later. Filter out anything dated in the future and never act on it. This is the single most important rule in the workflow: an employee whose last working day has not yet arrived must not be touched under any circumstances.

Step 2, resolve each leaver's identity. For each terminated userId, get the person's work email using List Email Addresses (PerEmail), selecting the business email type, and get their display name using List Persons (PerPerson). The work email is what links the HR record to the identity system.

Step 3, skip anyone already processed. Before taking any action, look the person up in Okta with Retrieve User using their work email as the login. If that user is already SUSPENDED or DEPROVISIONED, treat the termination as already processed and skip them completely: no suspension call, no Jira ticket, no Slack line. This is how the sweep stays idempotent when it runs again the next morning, without needing to write a processed flag back to the HRIS. If the lookup returns no user at all, do not stop; record that no account was found and continue to the ticketing and Slack steps so the leaver is still visible to IT.

Step 4, cut access first. Call Suspend User in Okta before anything else runs for that person. Suspend blocks sign-in immediately while keeping app assignments and group memberships intact, which makes it reversible if the HR record turns out to be wrong and leaves the access footprint available for review. Ordering matters: the identity step must complete before the slower ticketing and messaging steps, so a departing employee loses access in seconds rather than waiting behind ticket creation. If an organisation's policy is full deprovisioning instead, Deactivate User is the alternative, which revokes sessions and moves the user to DEPROVISIONED. Make the choice between Suspend and Deactivate an easy one-line change.

Step 5, raise the IT ticket. Use Create Issue in Jira to open one asset recovery and access review ticket per leaver in our IT project, assigned to the IT queue. The summary should name the person, and the description must carry the termination reason and the last working day taken straight from the SuccessFactors record, along with their work email, whether the account was suspended successfully, and a checklist covering laptop and equipment recovery plus a review of any remaining application access.

Step 6, notify IT. Use Send a Message in Slack to post to our private #it-offboarding channel. Post one concise summary line per leaver containing the name, the last working day, the termination reason, the suspension result, and a link to the Jira ticket. The whole point is that IT gets the context they need without opening the HRIS. If several people are processed in the same run, post one line each rather than a single merged blob. If there are no eligible leavers, post nothing and finish quietly.

Error handling: if the Okta suspension fails for someone, do not abort the run. Still create the Jira ticket and still post the Slack line, and flag the failure loudly in both so a human picks it up. Process each leaver independently so one bad record cannot block the rest of the sweep.

## How to customize

- Change the run time from 6am, or run the sweep more than once a day for faster cutoff
- Choose between temporarily blocking sign-in, which is reversible if the HR record was wrong, or fully deprovisioning the account
- Point the tickets at a different IT queue or assignee, or raise them in ServiceNow instead of Jira

## FAQ

### What happens if someone's leaving date is still in the future?

Nothing at all. The sweep only picks up people whose last working day is today or earlier, so anyone with a future leaving date is left completely untouched until their date arrives.

### Will it create duplicate tickets if it runs again the next morning?

No. Before doing anything, it checks whether the person's access has already been blocked. If it has, that person is treated as already handled and is skipped entirely, so there is no second ticket and no second Slack message.

### Can we fully close accounts instead of just blocking sign-in?

Yes. Blocking sign-in is the default because it is reversible if the HR record turns out to be wrong, and it keeps the person's app and group access intact for review. If your policy is full deprovisioning, the workflow can fully deactivate the account instead.

### What if a leaver has no matching account in our identity system?

The sweep still raises the IT ticket and still posts the Slack line, and it flags clearly that no account was found. That way a contractor or someone who never had a login does not silently disappear from the process.

### Can we use ServiceNow instead of Jira for the tickets?

Yes. The ticketing step can raise the asset recovery and access review ticket in ServiceNow instead, with the same leaving reason and last working day carried across.

Use this prompt in General Input: https://www.generalinput.com/prompts/automated-employee-offboarding-sweep-from-successfactors